1. Field of the Invention
This invention relates to access tokens in distributed data storage environments and, more particularly, to secure block level capability tokens using revocable token identifiers.
2. Description of the Related Art
Modern distributed storage environments may include many storage objects connected via an interconnection network. An interconnection network provides the infrastructure to connect the various elements of a distributed shared storage environment. Within the storage environment, file system abstractions may be built on top of virtual storage (for example, logical volumes) that may be distributed across multiple storage devices. As the number of volume and file system abstractions grows, the complexity of the entire storage environment grows dramatically.
In order to limit bottlenecking and the resulting restricted data throughput, distributed shared storage environments may separate the actual storage of data from the management of that data. Storage architectures that employ this technique may be referred to as out-of-band systems. An access server, sometimes called a metadata server (MDS), may supply the required data management and control functions including, among others, file system mapping or virtualization, client authentication, and the granting access privileges. The data itself may be stored on various storage devices attached to the network, but not necessarily connected directly to the access server. Such storage devices may provide data storage functions without having to worry about the metadata or file system virtualization or management.
Client applications, or hosts, may initially contact the access server to request access to a specific file, dataset, or range of data blocks. The access server may, after authenticating the client and applying whatever data access policies are relevant, provide the requesting client node with information about what storage device contains that particular dataset. Client nodes may then communicate directly with the storage device when reading or writing data.